What's New In G250/G350 R3.0 Vpn - Avaya G250 Administration

NAT Traversal. The G250/G350 supports both IETF NAT-T methods and the standard
●
method, as well as Avaya's proprietary method.
Stronger encryption algorithms – AES with 192 bit key and AES with 256 bit key.
●
Support of stronger Diffie-Hellman groups in IKE phase 1 – groups 5 and 14.
●
Support of additional Perfect Forward Secrecy (PFS) groups – 5 and 14.
●
Transport mode ESP encapsulation, intended for GRE over VPN.
●
IP Payload compression (IPPCP) with LZS support.
●
Continuous IKE SA and continuous IPSec SA. In this mode, SAs are negotiated as soon
●
as possible, even if no traffic is traversing the connection.
Configuration MIB, Monitoring MIB, and Traps – as described in avaya-ipsec-mib.my
●
(OID 1.3.6.1.4.1.6889.2.6.1.1).

What's new in G250/G350 R3.0 VPN

VPN in R3.0 includes the same functionality that was provided in R2.2, and offers the following
new and enhanced capabilities:
Dynamic local peer IP address support
Dynamic local peer IP is one of the solutions to the scarcity and cost of IP addresses. The IP
address is dynamically learned using PPPoE or DHCP Client.
Dynamic local peer IP is supported by running IKE aggressive mode, instead of IKE main mode.
IKE aggressive mode allows the remote peer to identify the G250/G350 using the G350/250's
self identity FQDN (Fully Qualified Domain Name), instead of its IP Address.
Failover mechanisms
The failover mechanisms provide switchover to backup peers in case of remote peer failure. In
addition to the mechanism utilizing GRE that existed in R2.2, two additional failover methods
are available in R3.0 VPN:
Dynamic resolution of a remote peer's IP address
●
This method utilizes the G250/G350's DNS Resolver capability for dynamically resolving a
remote peer's IP address via a DNS query. Use this feature when your DNS server supports
failover through health-checking of redundant hosts. On your DNS server configure a
hostname to translate to two or more redundant hosts, which act as redundant VPN peers.
On the G250/G350 configure that hostname as your remote peer. The G250/G350 will
perform a DNS query in order to resolve the hostname to an IP address before establishing
an IKE connection. Your DNS server should be able to provide an IP address of a living
host. The G250/G350 will perform a new DNS query and try to re-establish the VPN
connection to the newly provided IP address whenever it senses that the currently active
remote peer stopped responding. The G250/G350 can sense that a peer is dead when IKE
negotiation times-out, through DPD keepalives, and through object tracking.
Introduction to IPSec VPN
Issue 1.1 June 2005 359